mytrashcz
Hello friends,
I have server that connects clients into the their own network (the tap is used). There are our special devices on the network and operators connect into the same network to manage these devices. Each device and operator obtains ip address from open vpn via ccd configuration based on its certificate.
We would like to monitor traffic on the server and know what operators do. We would like for example know that operator sent icmp packet on device 10.200.0.5 and communicated with device 10.200.0.6 via http. The problem is that it is not possible to catch data that go through opnevpn tap interface. ...or I am not right?
My idea is to create tap0 vpn for devices and tap1 vpn for operators. These tap0 and tap1 devices include into the bridge and monitor traffic between tap0 and tap1 inside the bridge. But I am not able to setup the openvpn to work together right. Example of my configuration is here. The problem is that if I make these two configurations each tap device has assignet ip address.
Do you have any idea how to create two openvpn taps and connect it together via bridge (without eth interface)?
Thank you for your help.
Best regards Myth.
My configuration:
local 1.2.3.4
port 1194
tls-server
proto tcp-server
dev tap1
cipher AES-256-CBC
auth sha1
tcp-nodelay
server 10.200.0.0 255.255.0.0
ifconfig-pool-persist /var/run/openvpn.persist
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
client-to-client
client-config-dir /etc/openvpn/ccd
ccd-exclusive
script-security 2
status /var/run/openvpn/routers.status 10
log-append /var/log/openvpn.log
user openvpn
group openvpn
verb 4
mute 3
keepalive 10 120
